Outbound Email with Multiple Attachments to a Consumer Mailbox
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Microsoft Sentinel (KQL)
